The phpinfo implementation in ext/standard/info.c in PHP before 5.4.30 and 5.5.x before 5.5.14 does not ensure use of the string data type for the PHP_AUTH_PW, PHP_AUTH_TYPE, PHP_AUTH_USER, and PHP_SELF variables, which might allow context-dependent attackers to obtain sensitive information from process memory by using the integer data type with crafted values, related to a "type confusion" vulnerability, as demonstrated by reading a private SSL key in an Apache HTTP Server web-hosting environment with mod_ssl and a PHP 5.3.x mod_php.
Source: Debian GNU/Linux
Max CVSS
2.6
EPSS Score
0.73%
Published
2014-07-06
Updated
2023-01-19
pdo_sql_parser.re in the PDO extension in PHP before 5.3.14 and 5.4.x before 5.4.4 does not properly determine the end of the query string during parsing of prepared statements, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted parameter value.
Source: Red Hat, Inc.
Max CVSS
2.6
EPSS Score
6.21%
Published
2012-08-06
Updated
2013-04-19
PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.func_overload setting within .htaccess, which causes this setting to be applied to other virtual hosts on the same server.
Source: MITRE
Max CVSS
2.1
EPSS Score
0.04%
Published
2009-03-03
Updated
2018-10-03
Cross-site scripting (XSS) vulnerability in PHP, possibly 5.2.7 and earlier, when display_errors is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: because of the lack of details, it is unclear whether this is related to CVE-2006-0208.
Source: MITRE
Max CVSS
2.6
EPSS Score
0.32%
Published
2009-01-02
Updated
2018-10-30
PHP 5.2.5 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long string in (1) the domain parameter to the dgettext function, the message parameter to the (2) dcgettext or (3) gettext function, the msgid1 parameter to the (4) dngettext or (5) ngettext function, or (6) the classname parameter to the stream_wrapper_register function. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless this issue can be demonstrated for code execution.
Source: MITRE
Max CVSS
2.1
EPSS Score
0.11%
Published
2007-11-20
Updated
2018-10-15
The mcrypt_create_iv function in ext/mcrypt/mcrypt.c in PHP before 4.4.7, 5.2.1, and possibly 5.0.x and other PHP 5 versions, calls php_rand_r with an uninitialized seed variable and therefore always generates the same initialization vector (IV), which might allow context-dependent attackers to decrypt certain data more easily because of the guessable encryption keys.
Source: MITRE
Max CVSS
2.6
EPSS Score
0.64%
Published
2007-05-16
Updated
2022-11-07
CRLF injection vulnerability in the ftp_putcmd function in PHP before 4.4.7, and 5.x before 5.2.2 allows remote attackers to inject arbitrary FTP commands via CRLF sequences in the parameters to earlier FTP commands.
Source: MITRE
Max CVSS
2.6
EPSS Score
2.03%
Published
2007-05-09
Updated
2018-10-30
The imap_body function in PHP before 4.4.4 does not implement safemode or open_basedir checks, which allows local users to read arbitrary files or list arbitrary directory contents.
Source: MITRE
Max CVSS
2.1
EPSS Score
0.05%
Published
2007-05-22
Updated
2023-01-19
Integer overflow in memory allocation routines in PHP before 5.1.6, when running on a 64-bit system, allows context-dependent attackers to bypass the memory_limit restriction.
Source: MITRE
Max CVSS
2.6
EPSS Score
4.15%
Published
2006-08-31
Updated
2018-10-30
Buffer overflow in the LWZReadByte_ function in ext/gd/libgd/gd_gif_in.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which triggers an overflow when initializing the table array.
Source: MITRE
Max CVSS
2.6
EPSS Score
31.69%
Published
2006-08-31
Updated
2018-10-30
Buffer consumption vulnerability in the tempnam function in PHP 5.1.4 and 4.x before 4.4.3 allows local users to bypass restrictions and create PHP files with fixed names in other directories via a pathname argument longer than MAXPATHLEN, which prevents a unique string from being appended to the filename.
Source: MITRE
Max CVSS
2.1
EPSS Score
0.05%
Published
2006-06-13
Updated
2018-10-30
The cURL library (libcurl) in PHP 4.4.2 and 5.1.4 allows attackers to bypass safe mode and read files via a file:// request containing null characters.
Source: MITRE
Max CVSS
2.1
EPSS Score
0.09%
Published
2006-05-29
Updated
2017-07-20
The copy function in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass safe mode and read arbitrary files via a source argument containing a compress.zlib:// URI.
Source: MITRE
Max CVSS
2.1
EPSS Score
0.04%
Published
2006-04-10
Updated
2018-10-30
PHP 4.4.2 and 5.1.2 allows local users to cause a crash (segmentation fault) by defining and executing a recursive function. NOTE: it has been reported by a reliable third party that some later versions are also affected.
Source: MITRE
Max CVSS
2.1
EPSS Score
0.04%
Published
2006-04-10
Updated
2018-10-18
Directory traversal vulnerability in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass open_basedir restrictions allows remote attackers to create files in arbitrary directories via the tempnam function.
Source: MITRE
Max CVSS
2.6
EPSS Score
2.53%
Published
2006-04-10
Updated
2018-10-30
Multiple cross-site scripting (XSS) vulnerabilities in PHP 4.4.1 and 5.1.1, when display_errors and html_errors are on, allow remote attackers to inject arbitrary web script or HTML via inputs to PHP applications that are not filtered when they are included in the resulting error message.
Source: MITRE
Max CVSS
2.6
EPSS Score
1.03%
Published
2006-01-13
Updated
2018-10-30
The apache2handler SAPI (sapi_apache2.c) in the Apache module (mod_php) for PHP 5.x before 5.1.0 final and 4.4 before 4.4.1 final allows attackers to cause a denial of service (segmentation fault) via the session.save_path option in a .htaccess file or VirtualHost.
Source: MITRE
Max CVSS
2.1
EPSS Score
0.21%
Published
2005-10-27
Updated
2018-10-30
fopen_wrappers.c in PHP 4.4.0, and possibly other versions, does not properly restrict access to other directories when the open_basedir directive includes a trailing slash, which allows PHP scripts in one directory to access files in other directories whose names are substrings of the original directory.
Source: Debian GNU/Linux
Max CVSS
2.1
EPSS Score
0.08%
Published
2005-09-26
Updated
2018-10-03
PHP 4 (PHP4) allows attackers to cause a denial of service (daemon crash) by using the readfile function on a file whose size is a multiple of the page size.
Source: MITRE
Max CVSS
2.1
EPSS Score
0.05%
Published
2005-05-02
Updated
2008-09-05
rfc1867.c in PHP before 5.0.2 allows local users to upload files to arbitrary locations via a PHP script with a certain MIME header that causes the "$_FILES" array to be modified.
Source: MITRE
Max CVSS
2.1
EPSS Score
0.05%
Published
2004-11-03
Updated
2017-10-11
PHP 4.0 through 4.1.1 stores session IDs in temporary files whose name contains the session ID, which allows local users to hijack web connections.
Source: MITRE
Max CVSS
2.1
EPSS Score
0.05%
Published
2002-03-25
Updated
2008-09-11
21 vulnerabilities found
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!